Exchange Server vulnerabilities | LiveThreat CVE Feed

Exchange Server

by Microsoft · last CVE Oct 13, 2026

On CISA KEVExploited in the wildRansomware-linked

258

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities258 In the news12 Timeline

Severity mix

Critical 23High 92Medium 66Low 0

Severity

All severities258 Critical23 High92 Medium66 Low0

Exploitation

On CISA KEV20 Exploited in the wild20

Watch

Add Exchange Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-41123	7.8	1%	Nov 9	Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2021-31198	7.8	5%	May 11	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2018-8265	7.8	19%	Oct 10	A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution… Affected: 2013; 2016
CVE-2021-31206	7.6	13%	Jul 14	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2026-87696	7.5	0%	Oct 13	Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2019; 2019
CVE-2026-69378	7.5	1%	Sep 8	Microsoft Exchange Server Denial of Service Vulnerability Affected: 2016; 2019; 2019
CVE-2025-64666	7.5	1%	Dec 9	Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2025-59248	7.5	1%	Oct 14	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2025-33051	7.5	1%	Aug 12	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2024-49040	7.5	8%	Nov 12	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +30 more
CVE-2023-21761	7.5	2%	Jan 10	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2019; 2019
CVE-2021-34453	7.5	3%	Oct 13	Microsoft Exchange Server Denial of Service Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2019-1233	7.5	6%	Sep 11	A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of… Affected: 2016; 2016; 2019; 2019
CVE-2019-0686	7.4	5%	Mar 5	An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability' Affected: 2010; 2013; 2016; 2019
CVE-2016-3378	7.4	15%	Sep 14	Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2… Affected: 2013; 2013; 2013; 2016; 2016
CVE-2023-21710	7.2	8%	Feb 14	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019
CVE-2020-16969	7.1	3%	Oct 16	<p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-26854	6.6	25%	Mar 3	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2020-17117	6.6	49%	Dec 10	Microsoft Exchange Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2026-69375	6.5	1%	Sep 8	Microsoft Exchange Server Tampering Vulnerability Affected: 2016; 2019; 2019
CVE-2026-69361	6.5	1%	Sep 8	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2026-62915	6.5	1%	Aug 11	Microsoft Exchange Server Security Feature Bypass Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2026-62912	6.5	2%	Aug 11	Microsoft Exchange Server Denial of Service Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2026-45503	6.5	0%	Jun 9	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2019; 2019
CVE-2026-21527	6.5	8%	Feb 10	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2025-25005	6.5	1%	Aug 12	Microsoft Exchange Server Tampering Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2022-30134	6.5	2%	Aug 9	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2022-24463	6.5	32%	Mar 9	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2021-42305	6.5	8%	Nov 10	Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-41349	6.5	93%	Nov 10	Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-41350	6.5	2%	Oct 13	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2021-31209	6.5	3%	May 11	Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-31195	6.5	74%	May 11	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-24085	6.5	5%	Feb 25	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2019-1084	6.5	5%	Jul 15	An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters Affected: 2010; 2013; 2016; 2016; 2016; 2016
CVE-2019-0588	6.5	5%	Jan 8	An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange… Affected: 2010; 2013; 2016; 2016; 2019
CVE-2018-0940	6.5	7%	Mar 14	Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft… Affected: 2010; 2013; 2013; 2013; 2016; 2016
CVE-2018-0924	6.5	8%	Mar 14	Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft… Affected: 2010; 2013; 2013; 2013; 2016; 2016
CVE-2020-17085	6.2	4%	Nov 11	Microsoft Exchange Server Denial of Service Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2026-45501	6.1	0%	Jun 9	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2026-45500	6.1	0%	Jun 9	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2019-1266	6.1	2%	Sep 11	A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability' Affected: 2016; 2016; 2019; 2019
CVE-2019-0858	6.1	2%	Apr 9	A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability' Affected: 2013; 2016; 2016; 2019; 2019
CVE-2017-8758	6.1	3%	Sep 13	Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka… Affected: 2016
CVE-2017-8621	6.1	3%	Jul 11	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to… Affected: 2010; 2013; 2013; 2016
CVE-2017-8560	6.1	3%	Jul 11	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way… Affected: 2013; 2013; 2016
CVE-2017-8559	6.1	3%	Jul 11	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way… Affected: 2013; 2013; 2016
CVE-2017-0110	6.1	7%	Mar 17	Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat… Affected: 2013; 2013; 2013
CVE-2016-3379	6.1	8%	Sep 14	Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a… Affected: 2016; 2016
CVE-2016-0032	6.1	8%	Jan 13	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows… Affected: 2013; 2013; 2013; 2016